CVE-2014-3429

CRITICAL9.8EPSS 2.1%

IPython Notebook vulnerable to improper validation of the origin of websocket requests

發布日:2022/5/14修改日:2024/9/23

也稱為:GHSA-75cw-5cgv-g853DEBIAN-CVE-2014-3429PYSEC-2014-21

描述

IPython Notebook 0.12 through 1.x before 1.2.0 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.

受影響套件(3)

Debian/ipythonfrom 0, < 1.2.0~rc1-1
PyPI/ipython>= 0.12, < 1.2.0
PyPI/ipython>= 0.12, < 1.2.0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

參考連結(15)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2014-3429
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2014-3429
ADVISORYhttp://www.mandriva.com/security/advisories?name=MDVSA-2015:160
PATCHhttps://github.com/ipython/ipython
WEBhttp://advisories.mageia.org/MGASA-2014-0320.html
WEBhttp://lambdaops.com/cross-origin-websocket-hijacking-of-ipython
WEBhttp://lists.opensuse.org/opensuse-updates/2014-08/msg00039.html
WEBhttp://permalink.gmane.org/gmane.comp.python.ipython.devel/13198
WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=1119890
WEBhttp://seclists.org/oss-sec/2014/q3/152
WEBhttps://exchange.xforce.ibmcloud.com/vulnerabilities/94497
WEBhttps://github.com/ipython/ipython/commit/e5b669ce4750d628dba383fd637dbde918ea15f5
WEBhttps://github.com/ipython/ipython/pull/4845
WEBhttps://github.com/mattvonrocketstein/ipython/commit/dd4135db9f42d196a46553310a8e63ff5658671d
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/ipython/PYSEC-2014-21.yaml